# Upgrade of old install 2.4 ----\> 2.5 **URL:** \ **Category:** Installation\ **Created:** [May 25, 2023, 10:02am UTC](https://community.openhab.org/t/upgrade-of-old-install-2-4-2-5/146864 "2023-05-25T10:02:29Z")\ **Posts on this page:** 1\ **Showing post:** 4
**Author:** ![rpwong](https://community.openhab.org/user_avatar/community.openhab.org/rpwong/32/36036_2.png) [@rpwong](https://community.openhab.org/u/rpwong)\ **Post date:** [June 8, 2023, 5:56pm UTC](https://community.openhab.org/t/upgrade-of-old-install-2-4-2-5/146864/4 "2023-06-08T17:56:27Z")
> [@xsherlock](#): > > still running 2.4 (if it ain’t broken do not touch it, approach) 2.4 actually is kind of broken, and has been for over two years. Same goes for 2.5. > [@openHAB and the log4j security vulnerability](https://community.openhab.org/t/openhab-and-the-log4j-security-vulnerability/129901): > > Dear all, You might have read yesterday in the IT press about the [critical remote code injection vulnerability](https://github.com/advisories/GHSA-jfh8-c2jp-5v3q) in the popular log4j library. This affects a [huge amount of Java-based software and servers](https://github.com/YfryTchsGD/Log4jAttackSurface). openHAB uses log4j as well (as part of Karaf) for logging, so what exactly does this mean for you? First of all: For exploiting the vulnerability, an attacker must have access to your server or at least be able to interact in a way with it that would let openHAB log some of his input. So as l… Fixes were only applied to OH3. I’d guess that your 2.x installations should be relatively safe if they can’t connect to the Internet, but I’d be concerned about something critical to a university having a known exploit. I’m actually a bit surprised that a university allowed a relatively unstable open-source software to be used in such a way–the university I work at would deem it to be far too risky. > [@xsherlock](#): > > Since so many of the OH system are built once and forgotten until 5y later they break. End users assume all responsibility for the OH systems they deploy. So, I think it’s the administrator’s responsibility to proactively maintain the system and not forget about it for five years. Otherwise, things like the log4j2 vulnerability go unnoticed. At the same time, I understand that there are competing priorities. That’s why I mention the log4j2 vulnerability whenever someone says they’re still on OH2–I’m just giving a reason for the upgrade to be worth the effort. > [@xsherlock](#): > > A solid repo with all the old versions and ability to do step by step upgrades would be most welcome if not a requirement for a wider adoption of the OH. I don’t know what it takes to build and maintain repos, so I can’t comment on that. I will note that “wider adoption” isn’t a strong motivation, because we’re not competing with anyone. It’s open-source software maintained by volunteers, not a commercial business. --- _[View the full topic](https://community.openhab.org/t/upgrade-of-old-install-2-4-2-5/146864)._